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IN THE UNITED STATES DISTRICT COURT 
FOR THE NORTHERN DISTRICT OF GEORGIA 


ATLANTA DIVISION 
DONNA CURLING, ET AL., ) 
) 
Plaintiffs, ) 
) CIVIL ACTION 
VS. ) 
) FILE NO. 1:17-cv-2989-AT 
BRAD RAFFENSPERGER, ) 
ET AL., ) 
) 
Defendants. ) 


DECLARATION OF HARRI HURSTI 


Pursuant to 28 U.S.C. § 1746, I declare under penalty of perjury that the 
foregoing is true and correct. 

1. My name is Harri Hursti. I am over the age of 21 and competent to 
give this testimony. The facts stated in this declaration are based on my personal 
knowledge, unless stated otherwise. 

2, My background and qualifications in voting system cybersecurity are 
set forth in my December 16, 2019 declaration. (Doc. 680-1, pages 37 et seq). I 
stand by everything in that declaration and in my August 21, 2020 declaration. 


(Doc. 800-2). 
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a I am also an expert in ballot scanning because of extensive 
background in digital imaging prior by work researching election systems. In 
addition, in 2005 I started an open source project for scanning and auditing paper 
ballots from images. As a result, | am familiar with different scanner types, how 
scanner settings and image processing features change the images, and how file 


format choices affect the quality and accuracy of the ballots. 


4. I am engaged as an expert in this case by Coalition for Good 
Governance. 
Ds In developing this declaration and opinion, I visited Atlanta to observe 


certain operations of the June 9, 2020 statewide primary, and the August 11 runoff. 
During the June 9 election, I was an authorized poll watcher in some locations and 
was a public observer in others. On August 11, I was authorized as an expert 
inspecting and observing under the Coalition for Good Governance’s Rule 34 
Inspection request in certain polling places and the Fulton County Election 
Preparation Center. As I will explain below in this declaration, my extensive 
experience in the area of voting system security and my observations of these 
elections lead to additional conclusions beyond those in my December 16, 2019 


declaration. Specifically: 
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a) the scanner and tabulation software settings being employed to determine 
which votes to count on hand marked paper ballots are likely causing 
clearly intentioned votes not to be counted; 

b) the voting system is being operated in Fulton County in a manner that 
escalates the security risk to an extreme level; and 

c) voters are not reviewing their BMD printed ballots, which causes BMD 
generated results to be un-auditable due to the untrustworthy audit trail. 

Polling Place Observations 

6. Election observation on Peachtree Christian Church. The ballot 
marking devices were installed so that 4 out of 8 touchscreen devices were clearly 
visible from the pollbook check in desk. Voter’s selections could be effortlessly 
seen from over 50 ft away. 

Ts Over period of about 45 minutes, I only observed one voter who 
appeared to be studying the ballot after picking it up from the printer before casting 
it in the scanner. When voters do not fully verify their ballot prior to casting, the 
ballots cannot be considered a reliable auditable record. 

8. The scanner would reject some ballots and then accept them after they 
were rotated to a different orientation. I noted that the scanner would vary in the 


amount of time that it took to accept or reject a ballot. The delay varied between 3 
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and 5 seconds from the moment the scanner takes the ballot until the scanner either 
accepts the ballot or rejects it. This kind of behavior is normal on general purpose 
operating systems multitasking between multiple applications, but a voting system 
component should be running only a single application without outside 
dependencies causing variable execution times. 

9. Further research is necessary to determine the cause of the unexpected 
scanning delays. A system that is dedicated to performing one task repeatedly 
should not have unexplained variation in processing time. As security researcher, 
we are always suspicious about any unexpected variable delays, as those are 
common telltale signs of many issues, including a possibility of unauthorized 
code being executed. So, in my opinion changes of behaviors between 
supposedly identical machines performing identical tasks should always be 


investigated. 


When ballots are the same and are produced by a ballot marking device, 
there should be no time difference whatsoever in processing the bar codes. 
Variations in time can be the result of many things - one of them is that the 
scanner encounters an error reading the bar code and needs to utilize error 


correcting algorithms to recover from that error. Further investigation is 
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necessary to determine the root cause of these delays, the potential impact of the 
error correcting algorithms if those are found to be the cause, and whether the 


delay has any impact upon the vote. 


10. Election observation in Central Park Recreation Center. The Poll 
place manager told me that no Dominion trained technician had reported on 
location to help them that morning. 

11. The ballot marking devices were originally installed in a way that 
voter privacy was not protected, as anyone could observe across the room how 
people are voting on about 2/3 devices. 

12. The ballot scanner took between 4 and 6 seconds to accept the ballot. 
I observed only one ballot being rejected. 

13. Generally, voters did not inspect the ballots after taking it from the 
printer and casting it into the scanner. 

14. Election observation in Fanplex location. Samantha Whitley and 
Harrison Thweatt were poll watchers at the Fanplex polling location. They 
contacted me at approximately 9:10am about problems they were observing with 


the operation of the BMDs and Poll Pads and asked me to come to help them 
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understand the anomalies they were observing. I arrived at FanPlex at 
approximately 9:30am. 

15. I observed that the ballot scanner located by a glass wall whereby 
standing outside of the building observe the scanning, would take between 6 and 7 
seconds to either accept or reject the ballot. 

16. For reasons unknown, on multiple machines, while voters were 
attempting to vote, the ballot marking devices sometimes printed “test” ballots. I 
was not able to take a picture of the ballot from the designated observation area, 
but I overheard the poll worker by the scanner explaining the issue to a voter which 
was sent back to the Ballot-Marking Device to pick up another ballot from the 
printer tray. Test ballots are intended to be used to test the system but without 
being counted by the system during an election. The ballot scanner in election 
settings rejects test ballots, as the scanners at FanPlex did. This caused confusion 
as the voters needed to return to the ballot-marking device to retrieve the actual 
ballot. Some voters returned the test ballot into the printer tray, potentially 
confusing the next voter. Had voters been reviewing the ballots at all before taking 
them to the scanner, they would have noticed the “Test Ballot” text on the ballot. I 
observed no voter really questioning a poll worker why a “Test” ballot was printed 


in the first place. 
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17. Obviously, during the election day, the ballot marking device should 
not be processing or printing any ballot other than the one the voter is voting. 
While the cause of the improper printing of ballots should be examined, the fact 
that this was happening at all is likely indicative of a wrong configuration given to 
the BMD, which in my professional opinion raises another question: Why didn’t 
the device print only test ballots? And how can the device change its behavior in 
the middle of the election day? Is the incorrect configuration originating from the 
Electronic Pollbook System? What are the implications for the reliability of the 
printed ballot and the QR code being counted? 

18. Election observation Park Tavern. The scanner acceptance delay did 
not vary as it had in previous locations and was consistently about 5 seconds from 
the moment the scanner takes the ballot, to the moment the scanner either accepts 
the ballot or rejects it. The variation between scanners at different locations is 
concerning because these are identical physical devices and should not behave 
differently while performing the identical task of scanning a ballot. 

19. The vast majority of voters at Park Tavern did not inspect the ballots 


after taking them from the printer and before casting them in the scanner. 


Case 2:20 361813402 98ST ES cme gos agetteefes/ Fuh 1 PAg@9 oPage 9 of 48 


Fulton Tabulation Center Operation-Election Night, August 11, 2020 

20. In Fulton County Election Preparation Center (“EPC’’) on election 
night I reviewed certain operations as authorized by Rule 34 inspection. 

21. I was permitted to view the operations of the upload of the memory 
devices coming in from the precincts to the Dominion Election Management 
System (“EMS”) server. The agreement with Fulton County was that I could 
review only for a limited period of time; therefore, I did not review the entire 
evening’s process. Also, Dominion employees asked me to move away from the 
monitors containing the information and messages from the upload process and 
error messages, limiting my ability to give a more detailed report with 
documentation and photographs of the screens. However, my vantage point was 
more than adequate to observe that system problems were recurring and the 
Dominion technicians operating the system were struggling with the upload 
process. 

22.  Itis my understanding the same EMS equipment and software had 
been used in Fulton County’s June 9, 2020 primary election. 

23.  Itis my understanding that the Dominion technician (“Dominic’’) 


charged with operating the EMS server for Fulton County had been performing 
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these duties at Fulton County for several months, including during the June 9 
primary. 

24. During my August 11 visit, and a follow-up visit on August 17, I 
observed that the EMS server was operated almost exclusively by Dominion 
personnel, with little interaction with EPC management, even when problems were 
encountered. In my conversations with Derrick Gilstrap and other Fulton County 
Elections Department EPC personnel, they professed to have limited knowledge of 
or control over the EMS server and its operations. 

25. Outsourcing the operation of the voting system components directly to 
the voting system vendors’ personnel is highly unusual in my experience and of 
grave concern from a security and conflict of interest perspective. Voting system 
vendors’ personnel have a conflict of interest because they are not inclined to 
report on, or address, defects in the voting systems. The dangers this poses is 
aggravated by the absence of any trained County personnel to oversee and 
supervise the process. 

26. In my professional opinion, the role played by Dominion personnel in 
Fulton County, and other counties with similar arrangements, should be considered 
an elevated risk factor when evaluating the security risks of Georgia’s voting 


system. 
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27. Based on my observations on August 11 and August 17, Dell 
computers running the EMS that is used to process Fulton county votes appeared 
not to have been hardened. 

28. In essence, hardening is the process of securing a system by reducing 
its surface of vulnerability, which is larger when a system performs more 
functions; in principle it is to the reduce the general purpose system into a single- 
function system which is more secure than a multipurpose one. Reducing available 
ways of attack typically includes changing default passwords, the removal of 
unnecessary software, unnecessary usernames or logins, grant accounts and 
programs with the minimum level of privileges needed for the tasks and create 
separate accounts for privileged operations as needed, and the disabling or removal 
of unnecessary services. 

29. Computers performing any sensitive and mission critical tasks such as 
elections should unquestionably be hardened. Voting system are designated by the 
Department of Homeland Security as part of the critical infrastructure and certainly 
fall into the category of devices which should be hardened as the most fundamental 
security measure. In my experience, it is unusual, and I find it unacceptable for an 


EMS server not to have been hardened prior to installation. 
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30. The Operating System version in the Dominion Election Management 
computer, which is positioned into the rack and by usage pattern appears to be the 
main computer, is Windows 10 Pro 10.0.14393. This version is also known as the 
Anniversary Update version 1607 and it was released August 2, 2016. Exhibit A is 
a true and correct copy of a photograph that I took of this computer. 

31. When a voting system is certified by the EAC, the Operating System 
is specifically defined, as Windows 10 Pro was for the Dominion 5.5-A system. 
Unlike consumer computers, voting systems do not and should not receive 
automatic “upgrades” to newer versions of the Operating System. without 
undergoing tests for conflicts with the new operating system software. 

32. That computer and other computers used in Georgia’s system for vote 
processing appear to have home/small business companion software packages 
included. Exhibits B and C are true and correct copies of photographs that I took 
of the computer located in the rack and the computer located closest to the rack on 
the table to the right. The Start Menu shows a large number of game and 
entertainment software icons. As stated before, one of the first procedures of 
hardening is removal of all unwanted software, and removal of those game icons 
and the associated games and installers alongside with all other software which is 


not absolutely needed in the computer for election processing purposes would be 


11 
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one of the first and most basic steps in the hardening process. In my professional 
opinion, independent inquiry should be promptly made of all 159 counties to 
determine if the Dominion systems statewide share this major deficiency. 

33. Furthermore, when I asked the Dominion employee Dominic assigned 
to the Fulton County election server operation about the origin of the Windows 
operating system, he answered that he believed that “it has been provided by the 
State.” 

34. Since Georgia’s Dominion system is new, it is a reasonable 
assumption that all machines in the Fulton County election network had the same 
version of Windows installed. However, not only the two computers displayed 
different entertainment software icons, but additionally one of the machines in 
Fulton’s group of election servers had an icon of computer game called 
“Homescapes” which is made by Playrix Holding Ltd., founded by Dmitry and 
Igor Bukham in Vologda, Russia. Attached as Exhibit C is a true and correct copy 
of a photograph that I took of the Fulton voting system computer” Client 02”. The 
icon for Homescapes is shown by the arrow on Exhibit C. 

35. The Homescapes game was released in August 2017, one year after 
Fulton County’s operating system release. If the Homescapes game came with the 


operating system it would be unusual, because at the time of the release of 
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Homescapes, Microsoft had already released 3 major Microsoft Windows 10 
update releases after build 14393 and before the release of that game. This calls 
into question whether all Georgia Dominion system computers have the same 
operating system version, or how the game has come to be having a presence in 
Fulton’s Dominion voting system. 

36. Although this Dominion voting system is new to Georgia, the 
Windows 10 operating system of at least the ‘main’ computer in the rack has not 
been updated for 4 years and carries a wide range of well-known and publicly 
disclosed vulnerabilities. At the time of this writing, The National Vulnerability 
Database maintained by National Institute of Standards and Technology lists 3,177 
vulnerabilities mentioning “Windows 10 Pro” and 203 vulnerabilities are 
specifically mentioning “Windows 10 Pro 1607” which is the specific version 
number of the build 14393 that Dominion uses. 

37. Even without internet connectivity, unhardened computers are at risk 
when those are used to process removable media. It was clear that when Compact 
Flash storage media containing the ballot images, audit logs and results from the 
precinct scanners were connected to the server, the media was automounted by the 
operating system. When the operating system is automounting a storage media, the 


operating system starts automatically to interact with the device. The zero-day 
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vulnerabilities exploiting this process has been recurringly discovered from all 
operating systems, including Windows. Presence of automount calls also into 
question presence of another setting which is always disabled in hardening process. 
It is autorun, which automatically executes some content on the removable media. 
While this is convenient for consumers, it poses extreme security risk. 

38. Based on my experience and mental impression observing the 
Dominion technician’s activities, Fulton County’s EMS server management seems 
to be an ad hoc operation with no formalized process. This was especially clear on 
the manual processing of the memory cards storage devices coming in from the 
precincts on election night and the repeated access of the operating system to 
directly access filesystem, format USB devices, etc. This kind of operation in 
naturally prone to human errors. I observed personnel calling on the floor asking if 
all vote carrying compact flash cards had been delivered from the early voting 
machines for processing, followed by later finding additional cards which had been 
overlooked in apparent human error. Later, I heard again one technician calling on 
the floor asking if all vote carrying compact flashes had been delivered. This 
clearly demonstrates lack of inventory management which should be in place to 
ensure, among other things, that no rogue storage devices would be inserted into 


the computer. In response, 3 more compact flash cards were hand-delivered. Less 
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than 5 minutes later, I heard one of the county workers say that additional card was 
found and was delivered for processing. All these devices were trusted by printed 
label only and no comparison to an inventory list of any kind was performed. 

39. In addition, operations were repeatedly performed directly on the 
operating system. Election software has no visibility into the operations performed 
directly on the operating system, and therefore those are not included in election 
system event logging. Those activities can only be partially reconstructed from 
operating system logs — and as these activities included copying election data files, 
election software log may create false impression that the software is accessing the 
same file over a period of time, while in reality the file could had been replaced 
with another file with the same name by activities commanded to the operating 
system. Therefore, any attempt to audit the election system operated in this manner 
must include through analysis of all operating system logs, which complicates the 
auditing process. Unless the system is configured properly to collect file system 
auditing data is not complete. As the system appears not to be hardened, it is 
unlikely that the operating system has been configured to collect auditing data. 

40. A human error when operating live election system from the operating 
system can result in a catastrophic event destroying election data or even rendering 


the system unusable. Human error is likely given the time pressure involved and, 


ie) 
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at least in Fulton County, no formal check lists or operating procedures were 
followed to mitigate the human error risk. The best practice is to automate trivial 
tasks to reduce risk of human error, increase the quality assurance of overall 
operations and provide auditability and transparency by logging. 

41. Uploading of memory cards had already started before I arrived at 
EPC. While one person was operating the upload process, the two other Dominion 
employees were troubleshooting issues which seemed to be related to ballot images 
uploads. I repeatedly observed error messages appearing on the screen of the EMS 
server. I was not able to get picture of the errors on August 11", I believe the error 
was the same or similar that errors recurring August 17" as shown on Exhibit D 
and discussed later in this declaration. Dominion employees were troubleshooting 
the issue with ‘trial-and-error’ approach. As part of this effort they accessed 
“Computer Management” application of Windows 10 and experimented with 
trouble shooting the user account management feature. This demonstrates that they 
had complete access to the computer. This means there are no meaningful access 
separation and privileges and roles controls protecting the county’s primary 
election servers. This also greatly amplifies the risk of catastrophic human error 


and malicious program execution. 
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42. I overheard the Dominion technician’s conversation that they had 
issues with file system structure and “need 5 files out of EMS server and paste. 
Delete everything out of there and put it there.” To communicate the gravity of the 
situation to each other they added “Troubleshooting in the live environment”. 
These conversations increased the mental image that they were not familiar the 
issue they were troubleshooting. 

43. After about 45 minutes of trying to solve the issue by instructions 
received over the phone, the two Dominion employees’ (who had been 
troubleshooting) behavior changed. The Dominion staff member walked behind 
the server rack and made manual manipulations which could not be observed from 
my vantage point. After that they moved with their personal laptops to a table 
physically farther away from the election system and stopped trying different ways 
to work around the issue in front of the server, and no longer talked continuously 
with their remote help over phone. 

44. In the follow-up-calls I overheard them ask people on the other end of 
the call to check different things, and they only went to a computer and appeared to 
test something and subsequently take a picture of the computer screen with a 


mobile phone and apparently send it to a remote location. 
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45. Based on my extensive experience, this all created a strong mental 
impression that the troubleshooting effort was being done remotely over remote 
access to key parts of the system. Additionally, new wireless access point with a 
hidden SSID access point name appeared in the active Wi-Fi stations list that I was 
monitoring, but it may have been co-incidental. Hidden SSIDs are used to obscure 
presence of wireless networking from casual observers, although they do not 
provide any real additional security. 

46.  Ifin fact remote access was arranged and granted to the server, this 
has gravely serious implications for the security of the new Dominion system. 
Remote access, regardless how it is protected and organized is always a security 
risk, but furthermore it is transfer of control out of the physical perimeters and 
deny any ability to observe the activities. 

47. J also observed USB drives marked with the Centon DataStick Pro 
Logo with no visible inventory control numbering system being taken repeatedly 
from the EMS server rack to the Fulton managers’ offices and back. The 
Dominion employee told me that the USB drives were being taken to the Election 
Night Reporting Computer in another office. This action was repeated several 
times during the time of my observation. Carrying generic unmarked and therefore 


unidentifiable media out-of-view and back is a security risk — especially when the 
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exact same type of devices was piled on the desk near the computer. During the 
election night, the Dominion employees reached to storage box and introduced 
more unmarked storage devices into the ongoing election process. I saw no effort 
made to maintain a memory card inventory control document or chain of custody 
accounting for memory cards from the precincts. 

48. also visited the EPC on August 17. During that visit, the staff 
working on uploading ballots for adjudication experienced an error which appeared 
similar to the one on election night. This error was repeated with multitude of 
ballots and at the time we left the location, the error appeared to be ignored, rather 
that resolved. (EXHIBIT D - the error message and partial explanation of the error 
being read by the operator.). 

49. The security risks outlined above — operating system risks, the failure 
to harden the computers, performing operations directly on the operating systems, 
lax control of memory cards, lack of procedures, and potential remote access, are 
extreme and destroy the credibility of the tabulations and output of the reports 
coming from a voting system. 

50. Such a risk could be overcome if the election were conducted using 
hand marked paper ballots, with proper chain of custody controls. For elections 


conducted with hand marked paper ballots, any malware or human error involved 
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in the server security deficiencies or malfunctions could be overcome with a robust 
audit of the hand marked paper ballots and in case of irregularities detected, 
remedied by a recount. However, given that BMD ballots are computer marked, 
and the ballots therefore unauditable for determining the result, no recovery from 
system security lapses is possible for providing any confidence in the reported 


outcomes. 


Ballot Scanning and Tabulation of Vote Marks 

51. I have been asked to evaluate the performance and reliability of 
Georgia’s Dominion precinct and central count scanners in the counting of votes 
on hand marked paper ballots. 

52. Onor about June 10th, Jeanne Dufort and Marilyn Marks called me to 
seek my perspective on what Ms. Dufort said she observed while serving as a Vote 
Review Panel member in Morgan County. Ms. Dufort told me that she observed 
votes that were not counted as votes nor flagged by the Dominion adjudication 
software. 

53. Because of the ongoing questions this raised related to the reliability 
of the Dominion system tabulation of hand marked ballots, I was asked by 
Coalition Plaintiffs to conduct technical analysis of the scanner and tabulation 
accuracy. That analysis is still in its early stages. 
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54. Before addressing the particulars of my findings and research into the 
accuracy of Dominion’s scanning and tabulation, I will address the basic process 
by which an image on a voted hand marked paper ballot is processed by scanner 
and tabulation software generally. It is important to understand that the Dominion 
scanners are Canon off the shelf scanners and their embedded software were 
designed for different applications than ballot scanning which is best conducted 
with scanners specifically designed for detecting hand markings on paper ballots. 

55. Contrary of public belief, the scanner is not taking a picture of the 
paper. The scanner is illuminating the paper with a number of narrow spectrum 
color lights, typically 3, and then using software to produce an approximation what 
the human eye would be likely to see if there would had been a single white wide- 
spectrum light source. This process takes place in partially within the scanner and 
embedded software in the (commercial off the shelf) scanner and partially in the 
driver software in the host computer. It is guided by number of settings and 
configurations, some of which are stored in the scanner and some in the driver 
software. The scanner sensors gather more information than will be saved into the 
resulting file and another set of settings and configurations are used to drive that 
part of the process. The scanners also produce anomalies which are automatically 


removed from the images by the software. All these activities are performed 
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outside of the Dominion election software, which is relying on the end product of 
this process as the input. 

56. I began reviewing Dominion user manuals in the public domain to 
further investigate the Dominion process. 

57. On August 14, I received 2 sample Fulton County August 11 ballots 
of high-speed scanned ballot from Rhonda Martin, who stated that she obtained 
them from Fulton County during Coalition Plaintiff's discovery. The image 
characteristics matched the file details I had seen on the screen in EPC. The image 
is TIFF format, about 1700 by 2200 pixels with 1-bit color depth (= strictly black 
or white pixels only) with 200 by 200 dots per square inch (“dp1’’) resolution 
resulting in files that are typically about 64 or 73 kilo bytes in size for August 11 
ballots. With this resolution, the outer dimension of the oval voting target is about 
30 by 25 pixels. The oval itself (that is, the oval line that encircles the voting 
target) is about 2 pixels wide. The target area is about 450 pixels; the area of the 
target a tight bounding box would be 750 pixels and the oval line encircling the 
target is 165 pixels. In these images, the oval itself represented about 22% value in 
the bounding box around the vote target oval. 

58. Important image processing decisions are done in scanner software 


and before election software threshold values are applied to the image. These 
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scanner settings are discussed in an excerpt Dominion’s manual for ICC operations 
My understanding is that the excerpt of the Manual was received from Marilyn 
Marks who stated that she obtained it from a Georgia election official in response 
to an Open Records request. Attached as Exhibit E is page 9 of the manual. Box 
number 2 on Exhibit E shows that the settings used are not neutral factory default 
settings. 

59. Each pixel of the voters’ marks on a hand marked paper ballot will be 
either in color or gray when the scanner originally measures the markings. The 
scanner settings affect how image processing turns each pixel from color or gray to 
either black or white in the image the voting software will later process. This 
processing step is responsible for major image manipulation and information 
reduction before the election software threshold values are calculated. This process 
has a high risk of having an impact upon how a voter mark is interpreted by the 
tabulation software when the information reduction erases markings from the 
scanned image before the election software processes it. 

60. In my professional opinion, any decision by Georgia’s election 
officials about adopting or changing election software threshold values is 


premature before the scanner settings are thoroughly tested, optimized and locked. 
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61. The impact of the scanner settings is minimal for markings made with 
a black felt pen but can be great for markings made with any color ballpoint pens. 
To illustrate this, I have used standard color scanning settings and applied then 
standard conversion from a scanned ballot vote target with widely used free and 
open source image processing software “GNU Image Manipulation Program 
version 2.10.18” EXHIBIT G shows the color image being converted with the 
software’s default settings from color image to Black-and-White only. The red 
color does not meet the internal conversion algorithm criteria for black, therefore it 
gets erased to white instead. 

62. Dominion manual for ICC operations clearly show that the scanner 
settings are changed from neutral factory default settings. EXHIBIT H shows how 
these settings applied different ways alter how a blue marking is converted into 
Black-and-White only image. 

63. The optimal scanner settings are different for each model of scanner 
and each type of paper used to print ballots. Furthermore, because scanners are 
inherently different, the manufacturers use hidden settings and algorithms to cause 
neutral factory settings to produce similar baseline results across different makes 
and models. This is well-studied topic; academic and image processing studies 


published as early as 1979 discuss the brittleness of black-or-white images in 
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conversion. Subsequently, significance for ballot counting has been discussed in 
academic USENIX conference peer-reviewed papers. 

64. Onthe August 17" at Fulton County Election Preparation Center 
Professor Richard DeMillo and I participated in a scan test of August 11 test 
ballots using a Fulton County owned Dominion precinct scanner. Two different 
ballot styles were tested, one with 4 races and one with 5 races. Attached as 
Exhibits I and J show a sample ballots with test marks. 

65. A batch of 50 test ballots had been marked by Rhonda Martin with 
varying types of marks and varying types of writing instruments that a voter might 
use at home to mark an absentee ballot. Professor DeMillo and I participated in 
marking a handful of ballots. 

66. Everything said here concerning the August 17 test is based on a very 
preliminary analysis. The scanner took about 6 seconds to reject the ballots, and 
one ballot was only acceptable “headfirst” while another ballot only “tail first.” 
Ballot scanners are designed to read ballots “headfirst” or “tail first,” and front side 
and backside and therefore there should not be ballots which are accepted only in 
one orientation. I observed the ballots to make sure that both ballots had been 
cleanly separated from the stub and I could not identify any defects of any kind on 


the ballots. 
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67. There was a 15 second cycle from the time the precinct scanner 
accepted a ballot to the time it was ready for the next ballot. Therefore, the 
maximum theoretical capacity with the simple 5 race ballot is about 4 ballots per 
minute if the next ballot is ready to be fed into the scanner as soon as the scanner 
was ready to take it. In a real-world voting environment, it takes considerably 
longer because voters move away from the scanner, the next voter must move in 
and subsequently figure where to insert the ballot. The Dominion precinct scanner 
that I observed was considerably slower than the ballot scanners I have tested over 
the last 15 years. This was done with a simple ballot, and we did not test how 
increase of the number of races or vote targets on the ballot would affect the 
scanning speed and performance. 

68. Though my analysis is preliminary, this test reveals that a significant 
percentage of filled ovals that would to a human clearly show voter’s intent failed 
to register as a vote on the precinct count scanner. 

69. The necessary testing effort has barely begun at the time of this 
writing, as only limited access to equipment has been made available. I have not 
had access to the high-volume mail ballot scanner that is expected to process 
millions of mail ballots in Georgia’s upcoming elections. However, initial results 


suggest that significant revisions must be made in the scanning settings to avoid a 
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widespread failure to count certain valid votes that are not marked as filled in 
ovals. Without testing, it is impossible to know, if setting changes alone are 
sufficient to cure the issue. 


Scanned Ballot Tabulation Software Threshold Settings 


70. Georgia is employing a Dominion tabulation software tool called 
“Dual Threshold Technology” for “marginal marks.” (See Exhibit M) The intent of 
the tool is to detect voter marks that could be misinterpreted by the software and 
flag them for review. While the goal is admirable, the method of achieving this 
goal is quite flawed. 

71. While it is compelling from development cost point of view to use 
commercial off the shelf COTS scanners and software, it requires additional steps 
to ensure that the integration of the information flow is flawless. In this case, the 
software provided by the scanner manufacturer and with settings and 
configurations have great impact in how the images are created and what 
information is removed from the images before the election software processes it. 
In recent years, many defective scanner software packages have been found. These 
software flaws include ‘image enhancement’ features which have remained 
enabled even when the feature has been chosen to be disabled from the scanner 


software provided by the manufacturer. An example of dangerous feature to keep 
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enabled is ‘Punch Hole Removal’, intended to make images of documents removed 
from notebook binders to look more aesthetically pleasing. The software can and 
in many cases will misinterpret a voted oval as a punch hole and erase the vote 
from the image file and to make this worse, the punch holes are expected to be 
found only in certain places near the edge of the paper, and therefore it will erase 
only votes from candidates whose targets are in those target zones. 

72. Decades ago, when computing and storage capacity were expensive 
black-and-white image commonly meant 1-bit black-or-white pixel images like 
used by Dominion system. As computer got faster and storage space cheaper 
during the last 2-3 decades black-and-white image has become by default meaning 
255 shades of gray grayscale images. For the purposes of reliable digitalization of 
physical documents, grayscale image carries more information from the original 
document for reliable processing and especially when colored markings are being 
processed. With today’s technology, the difference in processing time and storage 
prices between grayscale and 1-bit images has become completely meaningless, 
and the benefits gained in accuracy are undeniable. 

73. Jam aware that the Georgia Secretary of State’s office has stated that 
Georgia threshold settings are national industry standards for ballot scanners 


(Exhibit K). This is simply untrue. If, there were an industry standard for that, it 
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would be part of EAC certification. There is no EAC standard for such threshold 
settings. As mentioned before, the optimal settings are products of many elements. 
The type of the scanner used, the scanner settings and configuration, the type of the 
paper used, the type of the ink printer has used in printing the ballots, color dropout 
settings, just to name few. Older scanner models, which were optical mark 
recognitions scanners, used to be calibrated using calibration sheet — similar 
process is needed to be established for digital imaging scanners used this way as 
the ballot scanners. 

74. Furthermore, the software settings in Exhibit E box 2 show that the 
software is instructed to ignore all markings in red color (“Color drop-out: Red’’), 
This clearly indicates that the software was expecting the oval to be printed in Red 
and therefore it will be automatically removed from the calculation. The software 
does not anticipate printed black ovals as used in Fulton County. Voters have 
likely not been properly warned that any pen they use which ink contains high 
concentration of red pigment particles is at risk of not counting, even if to the 
human eye the ink looks very dark. 

75. I listened to the August 10 meeting of the State Board of Elections as 
they approved a draft rule related to what constitutes a vote, incorporating the 


following language: 
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Ballot scanners that are used to tabulate optical scan ballots marked by 
hand shall be set so that: 


1. Detection of 20% or more fill-in of the target area surrounded by the 
oval shall be considered a vote for the selection; 


2. Detection of less than 10% fill-in of the target area surrounded by the 
oval shall not be considered a vote for that selection; 


3. Detection of at least 10% but less than 20% fill-in of the target area 

surrounded by the oval shall flag the ballot for adjudication by a vote 

review panel as set forth in O.C.G.A. 21-2-483(g). In reviewing any ballot 

flagged for adjudication, the votes shall be counted if, in the opinion of the 

vote review panel, the voter has clearly and without question indicated the candidate or 
candidates and answers to questions for which such voter desires to vote. 


76. The settings discussed in the rule are completely subject to the 
scanner settings. How the physical marking is translated into the digital image is 
determined by those values and therefore setting the threshold values without at the 
same time setting the scanner settings carries no value or meaning. If the ballots 
will be continuing to be printed with black only, there is no logic in having any 
drop-out colors. 

77. Before the State sets threshold standards for the Dominion system, 
extensive testing is needed to establish optimal configuration and settings for each 
step of the process. Also, the scanners are likely to have settings additional 
configuration and settings which are not visible menus shown in the manual 
excerpt. All those should be evaluated and tested for all types of scanners approved 


for use in Georgia, including the precinct scanners 
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78. As temporary solution, after initial testing, the scanner settings and 
configuration should be locked and then a low threshold values should be chosen. 
All drop-out colors should be disabled. This will increase the number of ballots 
chosen for human review and reduce the number of valid votes not being counted 
as Cast. 

Logic and Accuracy Testing 

79.  Ballot-Marking Device systems inherits the same well-documented 
systemic security issues embedded in direct-recording electronic (DRE) voting 
machine design. Such design flaws eventually are causing the demise of DRE 
voting system across the country as it did in Georgia. In essence the Ballot 
Marking Device is a general-purpose computer running a general-purpose 
operating system with touchscreen that is utilized as a platform to run a software, 
very similar to DRE by displaying a ballot to the voter and recording the voter’s 
intents. The main difference is that instead of recording those internally digitally, it 
prints out a ballot summary card of voter’s choices. 

80. Security properties of this approach would be positively different 
from DREs if the ballot contained only human-readable information and all voters 
are required to and were capable of verifying their choices from the paper ballot 


summary. That of course is unrealistic. 
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81. When voter fails to inspect the paper ballot and significant portion of 
the information is not in human readable from as a QR barcode, Ballot-Marking 
Device based voting effectively inherits most of the negative and undesirable 
security and reliability properties directly from DRE paradigm, and therefore 
should be subject to the same testing requirements and mitigation strategies as 
DREs. 

82. Inresponse to repeating myriad of issues with DREs, which have been 
attributed to causes from screen calibration issues to failures in ballot definition 
configuration distribution, a robust Logic & Accuracy testing regulation have been 
established. These root causes are present in BMDs and therefore should be 
evaluated in the same way as DREs have been. 

I received the Georgia Secretary of State’s manual “Logic and Accuracy 
Procedures “Version 1.0 January 2020 from Rhonda Martin. Procedure described 
in section D “Testing the BMD and Printer” is taking significant shortcuts, 
presumably to cut the labor work required. (Section D is attached as Exhibit L) 
These shortcuts significantly weaken the security and reliability posture of the 
system and protections against already known systemic pitfalls, usability 


predicaments and security inadequacies. 
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CONCLUSIONS 

83. The scanner software and tabulation software settings and 
configurations being employed to determine which votes to count on hand marked 
paper ballots are likely causing clearly intentioned votes not to be counted as cast. 

84. The method of using 1-bit images and calculated relative darkness 
values from such pre-reduced information to determine voter marks on ballots is 
severely outdated and obsolete. It artificially and unnecessarily increases the 
failure rates to recognize votes on hand-marked paper ballots. As a temporary 
mitigation, optimal configurations and settings for all steps of the process should 
be established after robust independent testing to mitigate the design flaw and 
augment it with human assisted processes, but that will not cure the root cause of 
the software deficiency which needs to be addressed. 

85. The voting system is being deployed, configured and operated in 
Fulton County in a manner that escalates the security risk to an extreme level and 
calls into question the accuracy of the election results. The lack of well-defined 
process and compliance testing should be addressed immediately using 
independent experts. The use and the supervision of the Dominion personnel 


operating Fulton County’s Dominion Voting System should be evaluated. 
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86. Voters are not reviewing their BMD printed ballots before scanning 
and casting them, which causes BMD-generated results to be un-auditable due to 
the untrustworthy audit trail. Furthermore, because BMDs are inheriting known 
fundamental architectural deficiencies from DREs, no mitigation and assurance 
measures can be weakened, including but not limited to Logic and Accuracy 


Testing procedures. 


This 24" day of August 2020. 


é y arri Hursti 
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EXHIBIT A: 
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EXHIBIT B: 


County 


a & 


MOCK — tewmpertids 
Play and explore 
D045 Becton Event Designer 
PA ret 
D wis rents toy and Reporting 
Notepad 
D srazecast® refutation 
Cldstor 


BE vwie dence 
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EXHIBIT C: 
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EXHIBIT D: 


~ Batch 72 8/11/2020 7:16 PM 
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EXHIBIT E: 


ICC SCANNER DRIVER SETTINGS) OOTING 


1 2 _ verify/select the following settings: 
Color Drop-out: Red 

Detect by Length: Not selected 
Detect by Ultrasonic: Selected 
Deskew: Selected 

Edge Cleanup: Selected 

Doc Orientation: Portrait 
Brightness: Set to 90 

Contrast: 4 

Gamma: Not selected 

Moire Reduction: Not selected 
imprinter: Not selected 

=a] Click the Apply button then click the OK button. 


Date [Mende dine 26, 2617 ] Veen x [ansouTEE __] 
— ) 
J 


1. Click on the ADMINISTRATOR MODE icon in the lower left 
corner of the window. Enter the Supervisor password. 


2. Click the CONFIGURATION button option on the left side of 
the window then click the Properties button located in the 
lower Scanner section. 


a. 
b. 
c. 
d. 
e. 
3 
g. 
h. 
i. 

i: 

k. 























‘© 2019 Dominion Voting Systems, inc. All rights reserved, 9 
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EXHIBIT F: 


lmageCast® Adjudication 5.5.81 
[x] Error Loading Ballot 


Ballot 22 from - 
a batch 5170 3, could not be loaded due to an error, see detais 
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EXHIBIT G: 
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EXHIBIT H: 


— = 


a 






c' 
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EXHIBIT I: 


y 9 : . . 


Copyright © 2020 Dominion Voting Inc. All Rights Reserved 


BEET DE TEED EDD O RE UD EEE OD OREO 
i waa WIN 





993-SC13 
OFFICIAL ABSENTEE/PROVISIONAL/EMERGENCY BALLOT 


OFFICIAL DEMOCRATIC PARTY PRIMARY AND 
NONPARTISAN GENERAL ELECTION RUNOFF BALLOT 
OF THE STATE OF GEORGIA 
AUGUST 11, 2020 


To vote, blacken the Oval (@) next to the candidate of your choice. To vote for a person whose name is not on the ballot, manually WRITE his or her 
name in the write-in section and blacken the Oval (@) next to the write-in section. If you desire to vote YES or NO fora PROPOSED QUESTION, 
blacken the corresponding Oval (@). Use only blue or black pen or pencil, 
















Do not vote for more candidates than the number allowed for each specific office. Do not cross out or erase. If you erase or make other marks on the 
ballot or tear the ballot, your vote may not count. 


Ifyou change your mind or make a mistake, you may return the ballot by writing "Spoiled" across the face of the ballot and return envelope. You may 
then mail the spoiled ballot back to your county board of registrars, and you will be issued another official absentee ballot. Alternatively, you may 


surrender the ballot to the poll manager of an early voting site within your county or the precinct to which you are assigned. You will then be permitted to 
vote a regular ballot. 


‘7 understand that the offer or acceptance of money or any other object of value fo vote for any panticular candidate, list of candidates, issue, or list of issues included in this 
e/ection constitutes an act of voter fraud and /s a felony under Georgia law."[0.C.G.A. 21-2-284(e) and 21-2-383(a)] 








For State Representative _—| NONPARTISAN 
In the General Assembly From GENERAL ELECTION 
65th District 
(Vote for One) hier eae ae 
© Sharon Beasley-Teague For Judge, Superior Court of the 
| (Incumbent) Atlanta Judicial Circuit 
lat (To Succeed Constance C. Russell) 
| Gi Mandisha A. Thomas (Vote for One) 


ds 
@® Melynee Leftridge Harris 


For District Attorney of the 














| Atlanta Judicial Circuit © Tamika Hrobowski-Houston | 
(Vote for One) 
| 
| ! = 
© Paul Howard For Member, Fulton County 
ea School Board District 4 
\y (Vote for One) 
SY Fani Willis 
| 6? Franchesca Warren 
For Sheriff 
(Vote for One) © Sandra C. Wright 
L 
“i Theodore "Ted” Jackson 
P* (Incumbent) 


© Patrick “Pat” Labat 











8 
| 5 
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EXHIBIT J: 


+ ie or . 
Copyright © 2020 Dominion Voting Inc. All Rights Reserved 


LS PARUELUEOUEROEROEROUTNOOHNOTND ND 
Aon a AVM 


OFFICIAL ABSENTEE/PROVISIONAL/EMERGENCY BALLOT 


OFFICIAL DEMOCRATIC PARTY PRIMARY AND 
NONPARTISAN GENERAL ELECTION RUNOFF BALLOT 
OF THE STATE OF GEORGIA 
AUGUST 11, 2020 
To vote, blacken the Oval (@) next to the candidate of your choice. To vote for a person whose name is not on the ballot, manually WRITE his or her 


Name in the write-in section and blacken the Oval (@) next to the write-in section. If you desire to vote YES or NO for a PROPOSED QUESTION, 
blacken the corresponding Oval (@). Use only blue or black pen or pencil. 





























Do not vote for more candidates than the number allowed for each specific office. Do not cross out or erase. If you erase or make other marks on the 
ballot or tear the ballot, your vote may not count. 






lf you change your mind or make a mistake, you may return the ballot by writing "Spoiled" across the face of the ballot and return envelope. You may 
then mail the spoiled ballot back to your county board of registrars, and you will be issued another official absentee ballot. Alternatively, you may 


Surrender the ballot to the poll manager of an early voting site within your county or the precinct to which you are assigned. You will then be permitted to 
Vote a regular ballot. 






‘Vunderstand that the offer or acceptance of money or any other object of value to vote for. any particular candidate, st of candidates, issue, or list of issues included in this 
election constitutes an act of voter fraud and is a felony under Georgia law." [0.C.G.A. 21-2-284(e) and 21-2-38Ha)] 








For State Representative NONPARTISAN | 
In the General Assembly From GENERAL ELECTION 6 usta dk 
(Vote for One) 
| ania corclubd re 
WW Sharon Beasley-Teague For Judge, Superior Court of the © 
(Incumbent) Atlanta Judicial Circuit Sa ae) 
(To Succeed Constance C. Russell) Co 

| ©) Mandisha A. Thomas | (Vote for One) Last per 2 
| 


©) Melynee Leftridge Harris 








For District Attorney of the | 
Atlanta Judicial Circuit Tamika Hrobowsk-Houston 
(Vote for One) 








(Incumbent) 


a Fani Willis 





For Sheriff 
(Vote for One) 


© Theodore "Ted" Jackson 
(Incumbent) 





S Patrick "Pat" Labat 
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EXHIBIT K: 


Gabriel Sterling v 
, @GabrielSterling 


Replying to @MarilynRMarks1 @rahulbali and 9 others 


Again, all Central scanners were set at the industry 
standard 0-13% is not a mark (the oval is 5%) 14-28% is 
the ambiguous level to be checked by review panels, 
29%+ is a mark. You ar pointing out the inherent issues 
with HMPBs that we don’t see with BMD marked 
ballots. 


8:02 PM -: Jun 13, 2020 from Georgia, USA - Twitter for iPhone 


[> 


oO un oy, 
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EXHIBIT L: 


SECURE 
THE XOTE 


« Create a voter card from Poll Pad for each unique ballot style within the designated Polling 
Location 
c Recommend labels be placed on card identifying what ballot style will be displayed by 
BMD once card is inserted 
o BMD removes the activation code from the Voter Card once used, therefore create the 
card again from Poll Pad after each use by a BMD 


D. Testing the BMD and Printer 
Use a combination of Poll Worker Card with Ballot Activation Codes for the polling location, and Voter 
Cards created from a Poll Pad loaded with the LA/Advance Voting dataset to bring up ballots on the 
BMD 
* Produce at least one printed ballot from each BMD assigned to the polling location 
« Produce a test deck from the BMDs assigned to the polling location for each unique ballot style 
within the polling location. The test deck must contain at least one vote for each candidate 
listed in each race within the unique ballot style 
© Example: Ballot from BMD 1 contains a vote for only the first candidate in each race 
listed on Ballot Style 1, Ballot from BMD 2 contains a vote only for the second candidate 
in each race on Ballot Style 1, and continue through the line of devices until all 
candidates \n all races within the unique ballot style have received a single vote 
c If Number of BMDs outnumber the number of vote positions on the unique ballot 
style, stari the vote pattern over until all BMDs have produced one printed ballot 
tf Number of unique ballot styles in the polling place is greater than 1, once the 
vote pattern is complete for a unique ballot style, proceed to the next BMD in line to 
start the review of the next unique Ballot Style 
All unique ballot styles do not have to be tested on each BMD 
. fade BMD-generated Test Deck and confirm the vote content before placing in the 
designated Polling Place Scanner 


E. Testing the Folling Piace Scanner 
Scan the BMD-generated Test Deck into the Polling Place Scanner 
* Scan one blank optical scan ballot style(s) associated to the Polling Place to verify the Polling 
Place Scanner will recognize the ballot style in case of emergency 
« Verify Scanner(s) shows a number of Ballot Cast equal to the number of ballots in the BMD- 
generated test deck plus the scanned blank Optical Scan ballot styles 
Firmly place the Security Key Tab in the Security Key Slot 
Touch Close Polls 
Enter the passcode 
Touch Enter 
Touch Yes 
Touch No for additional tapes (Scanner will automatically produce 3 copies of the closing tape) 
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EXHIBIT M: 


DUAL THRESHOLD 
 rerarivage 
MARGINAL MARKS) 





From Its early beginnings, Dominion Voting has emphasized the use of digital scanning. 

and continues to set the standard In digital image acquisition and analysis in the tabulation of 
digitally scanned ballots, When a ballot |s fed into an ImageCast® tabulator - at the precinct level 
or centrally - a complete duplex Image Is created and then analyzed for tabulation by evaluating 
the pixel count of a voter mark. The pixel count of each mark is compared with two thresholds 
(which can be defined through the Election Management System) to determine what constitutes 
a vote, If a mark falls above the upper threshold, it’s a valid vote, If a mark falls below the lower 
threshold, it will not be counted as a vote. 


However. if a mark falls between the two thresholds (known as the “ambiguous zone”). it will 
be deemed as a marginal mark and the ballot will be returned to the voter for corrective action 
(please see diagram below). With this feature. the voter is given the ability to determine his or 
her intent, not an inspection or recount board after the fact, when it is too late. The chart below 
illustrates the Marginal Mark threshold Interpretation. 


100% 


MARK DENSITY 


Upper Threshold 


Lower Threshold 





Mark an Mark a2 Mark a3 Mark a4 





YUAL THRESHOLD TECHNOLOGY Boyton 
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